Privacy and cookie policy
Last updated: 23 October 2026
Contact: [email protected] (general questions) · [email protected] (support)
This policy explains what personal data we process, for what purpose and on what legal basis, who we pass it to, how long we keep it and what rights you have. It is a translation; the Slovenian text prevails.
1. Controller and contact
The controller of your personal data is Befine-Pro d.o.o., which operates the website challanger.com and the Challanger application.
| Item | Value |
|---|---|
| Company | Befine-Pro d.o.o., poslovno informacijske storitve d.o.o. |
| Registered office | Križ 249, 6210 Sežana, Slovenia |
| Registration number | 8628050000 |
| VAT number | SI97591971 |
| Data protection e-mail | [email protected] |
| Telephone | +386 41 468 699 |
The company has not appointed a data protection officer, as it is not required to under Article 37 GDPR. For any question about the processing of personal data and to exercise your rights, write to the e-mail address above.
This policy applies to the processing of personal data of website visitors, application users and subscribers to subscription packages. Third-party websites linked from our website are governed by their own privacy policies.
2. What data we process, why and on what basis
We process personal data only for the purposes listed below and only on a basis set out in Article 6 GDPR. We do not ourselves collect special categories of personal data (e.g. about health, religion or ethnic origin). If an organiser enters medical notes in the member register, we process them as a processor (section 3).
| Purpose | Data | Legal basis |
|---|---|---|
| Registering and running a user account in the application | first and last name, e-mail address, password (stored hashed), role in the application, language; if you enter them yourself, also telephone number, profile picture, gender, date of birth and address; when signing in with Google or Facebook, the identifier of that account | performance of a contract (6(1)(b)) |
| Taking part in competitions and booking courts or wellness | entries, fixtures, results, placings and standings, bookings | performance of a contract (6(1)(b)) |
| Notifications a competition or booking requires (e-mail, SMS, push) | contact details, content of the notification, delivery data | performance of a contract (6(1)(b)) |
| Concluding and performing a subscription to a package | account data, subscriber name and address, tax number (for legal entities), chosen package, payment history | performance of a contract (6(1)(b)) |
| Issuing invoices and keeping accounting records | invoice data | legal obligation under ZDDV-1 and ZGD-1 (6(1)(c)) |
| Answering enquiries through the contact form, e-mail or telephone, and help requests in the application | name, contact details, content of the message | pre-contractual steps (6(1)(b)) or legitimate interest in answering a question (6(1)(f)) |
| Operation, security and abuse prevention of the website and application | IP address, device and browser data, access and sign-in logs | legitimate interest in providing a secure service (6(1)(f)) |
| Establishing, exercising or defending legal claims | data needed for the particular dispute | legitimate interest (6(1)(f)) |
We do not store payment card data. Card payments are processed entirely by the payment service provider; we receive only a confirmation of payment.
Providing the data needed to conclude a contract is a condition of the contract. Without it we cannot open an account or perform a subscription. Providing any other data is voluntary.
We do not carry out automated decision-making that has legal or similarly significant effects on you (Article 22 GDPR). We do not sell personal data.
3. Competitors’ data in the application
For competitors’ data entered into the application by a competition organiser (a club, league, association or individual), the organiser is the controller and Befine-Pro processes it as a processor on the organiser’s instructions (Article 28 GDPR). This means:
- The organiser decides which data about competitors to enter (e.g. name, surname, club, results, placings, statistics, photos or videos of matches, and in a club’s member register also medical notes) and whether the competition and its results are published.
- The organiser must have an appropriate legal basis for entering the data and must inform competitors of the processing. For competitors under 15, the organiser must where necessary obtain the consent of a parent or guardian.
- Processing on behalf of the organiser is governed by the General Terms of Use and Business (section on processing on behalf).
- A competitor who wishes to exercise their rights regarding this data may contact the organiser directly or us; we will pass the request on to the organiser without delay.
When a competitor creates their own user account in the application, Befine-Pro is the controller of that account’s data.
Results, fixtures and standings of public competitions are visible to every visitor of the website (on the competition and ranking pages). Finished and archived competitions remain published without a time limit, unless the organiser makes them private or the organiser or a competitor justifiably requests their removal.
4. Who we pass data to
We pass personal data only to processors we need to provide the services, and to authorities where the law requires it. We have data processing agreements under Article 28 GDPR with all processors, which forbid them to use the data for their own purposes.
The processors we pass data to fall into the following categories:
- provider of hosting for the application, database and backups,
- provider of network protection and website delivery,
- payment service provider,
- provider of e-mail, SMS and push notification delivery,
- provider of application error monitoring,
- provider of artificial-intelligence services, only when you use result recognition from an image or voice entry of a result,
- accounting service.
We will send you the list of individual processors on request to the e-mail address in section 1.
We may also pass data to public authorities (e.g. the Financial Administration of the Republic of Slovenia, courts or the police) where the law requires it, and to lawyers or auditors bound by confidentiality. In the event of a sale or reorganisation of the company, the data may pass to a legal successor, who may use it only in accordance with this policy.
5. Transfers outside the EU and EEA
Application data is stored in a data centre in Frankfurt (EU). Some processors (providers of hosting, network protection, payment services, error monitoring and artificial-intelligence services) are companies based in the USA or part of groups based in the USA, so data may be transferred outside the European Economic Area.
We transfer data outside the European Economic Area only where an adequate level of protection is ensured under Chapter V GDPR. On request we will tell you about the safeguards for a particular transfer.
6. How long we keep data
We keep data only as long as the purpose of processing requires, then delete or anonymise it.
| Data | Retention period |
|---|---|
| User account | until the account is deleted, which you can do yourself at any time on your profile or request at the e-mail address in section 1; on deletion the account’s personal data is erased, while results of matches played remain without your name |
| Subscription and complaint data | until the limitation periods for contractual claims expire, as a rule 5 years after the contract is fulfilled |
| Invoices and accounting records | 10 years after the end of the year they relate to (ZDDV-1) |
| Enquiries | 3 years after the communication ends |
| Sign-in and change logs with IP address | 12 months, then deleted automatically; web server logs for a shorter time |
| Cookies | as set out in the cookie table in section 8 |
Deleted data disappears from backups when those backups expire. If proceedings are pending in which the data is needed as evidence, we keep it until the proceedings are finally concluded.
7. Your rights
In relation to your personal data you have the right to:
- access the data and obtain a copy (Article 15 GDPR),
- have inaccurate data corrected or incomplete data completed (Article 16),
- erasure (Article 17),
- restriction of processing (Article 18),
- data portability in a structured, machine-readable format where processing is based on consent or a contract (Article 20),
- object to processing based on legitimate interest on grounds relating to your particular situation (Article 21),
- object to processing for direct marketing, at any time and without giving reasons,
- withdraw consent at any time, without affecting the lawfulness of processing before the withdrawal.
Send your request to the e-mail address in section 1. We answer without undue delay and at the latest within one month. Because of complexity or the number of requests we may extend this period by up to two months, in which case we tell you within the first month. Exercising your rights is free of charge. If we doubt your identity, we may ask for additional information to confirm it.
If you believe that the processing of your data breaches the law, you may lodge a complaint with the supervisory authority: Information Commissioner of the Republic of Slovenia, Dunajska cesta 22, 1000 Ljubljana, e-mail [email protected], www.ip-rs.si.
8. Cookies and direct marketing
We use only strictly necessary cookies, which need no consent (ZEKom-2): two sign-in cookies that keep you signed in (valid for 15 minutes and 7 days respectively). In addition, the browser’s local storage keeps details of the signed-in user and settings you choose yourself. We do not use analytics or advertising cookies, so the website has no cookie banner.
| Type | Purpose | Consent |
|---|---|---|
| Strictly necessary cookies | sign-in and security | not required |
| Browser local storage | the signed-in user and their role; language, light or dark theme, time format, how lists are shown and the chosen sport | not required, as it is needed for signing in or stored at your request |
| Analytics cookies | not used | — |
| Advertising cookies | not used | — |
If we introduce analytics or advertising cookies, we will set them only once you have expressly accepted them in a cookie banner that makes accepting and rejecting equally easy; continuing to browse will not mean consent. You can delete cookies and local storage at any time in your browser settings.
We do not currently send newsletters or other marketing messages. If we introduce them, we will send them only if you have consented, or to existing customers about similar services if you have not objected, with a free opt-out in every message. Opting out does not affect messages needed to perform the contract (e.g. match notifications, subscription confirmations and invoices).
9. Children, security and changes to this policy
Children. A child aged at least 15 may consent to the processing of data in information society services on their own (ZVOP-2). For younger children, consent must be given or approved by a parent or guardian.
Security. We apply appropriate technical and organisational measures to protect data, including encrypted transmission (HTTPS), hashed storage of passwords, access limited to authorised persons and regular backups. We notify the Information Commissioner of a personal data breach within 72 hours, and affected individuals without undue delay where Articles 33 and 34 GDPR require it.
Changes. We may change this policy when our services or the law change. The version in force is always published on this page. We notify registered users of material changes by e-mail or in the application at least 15 days before they take effect.
This policy applies from 23 October 2026.